A security firm has found several models of Android mobile devices sold through US-based online retailers contain preinstalled spyware that collects and transmits sensitive personal data to a third-party service in Shanghai.